tylerg/auth-yes
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs(tasks): add Prompt 4.2 for Jules with SSO launchpad, logout return-path, and additive security audit

Browse Source
This commit is contained in:
Tyler Gillispie 2026-08-24 13:56:12 -07:00
parent 2e30c5ad3e
commit 4fce954c86
1 changed files with 43 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

44
tasks/JULES_PROMPTS.md
View File

@ -19,7 +19,8 @@ and
| **Prompt 3.1** | WebAuthn PRF Extension & Progressive Fallback | ✅ **COMPLETE** | `server/main.ts`, `ui/public/auth-client.js` | | **Prompt 3.1** | WebAuthn PRF Extension & Progressive Fallback | ✅ **COMPLETE** | `server/main.ts`, `ui/public/auth-client.js` |
| **Prompt 3.3** | 2-of-3 SSS Recovery Matrix (Wasm/Rust) | ✅ **COMPLETE** | `ui/components/RecoveryPage.tsx`, `wasm/` | | **Prompt 3.3** | 2-of-3 SSS Recovery Matrix (Wasm/Rust) | ✅ **COMPLETE** | `ui/components/RecoveryPage.tsx`, `wasm/` |
| **Prompt 3.4** | RFC 6962 Merkle Tree Audit Ledger & STH | ✅ **COMPLETE** | `server/audit_merkle.ts`, `server/audit.ts` | | **Prompt 3.4** | RFC 6962 Merkle Tree Audit Ledger & STH | ✅ **COMPLETE** | `server/audit_merkle.ts`, `server/audit.ts` |
| **Prompt 4.1** | Traefik Tier 1 Global Ingress Hardening & Discovery | ⏳ **PENDING (Next Milestone)** | `infra/`, Host Traefik Config | | **Prompt 4.1** | Traefik Tier 1 Universal Global Ingress Control | ⏳ **IN PLANNING (Jules #6742583984777370201)** | `infra/`, Host Traefik Config |
| **Prompt 4.2** | SSO Launchpad, Logout Return-Path & Hybrid Ingress | ⏳ **IN PLANNING (Next Milestone)** | `ui/`, `server/`, `docs/` |
--- ---
@ -217,3 +218,44 @@ _Completed task:
2. Map out the `Target Files`, host configuration requirements, database migrations, and potential architectural risks. 2. Map out the `Target Files`, host configuration requirements, database migrations, and potential architectural risks.
3. Draft the task file in `tasks/new/` strictly adhering to the naming conventions, header metadata, and mandatory structure defined in `tasks/GUIDELINES.md`. 3. Draft the task file in `tasks/new/` strictly adhering to the naming conventions, header metadata, and mandatory structure defined in `tasks/GUIDELINES.md`.
``` ```
---
### Prompt 4.2: Central SSO Application Launchpad, Logout Return-Path Preservation & Hybrid Ingress Gateway Protocol
```text
**Role:** Act as a System Analyst and Solutions Architect. Do not execute code or modify the codebase during this session. Your sole deliverable is to generate a task file in tasks/new/.
**The Objective:** Architect and formalize the specification and implementation plan for:
1. Universal Logout Return-Path Preservation (`GET /logout?redirect=...`).
2. Central SSO Application Launchpad (App Switcher) on `auth.atyg.org/dashboard` and post-login fallback.
3. Hybrid Ingress Routing Pattern & Developer Playbook for consumer applications (e.g. public landing vs private cockpit).
4. Comprehensive Additive Security & Regression Audit across all previously implemented subsystems.
**Core Scope & Architectural Requirements to Explore:**
1. **Logout Return-Path Preservation (`GET /logout`):**
* Update `ui/mod.ts` `/logout` handler so that when consumers trigger single-sign-out via `GET /logout?redirect=...`, the return URL is parsed and validated against the open-redirect whitelist (`*.atyg.org`, `localhost`, and relative paths).
* After successfully wiping Valkey session cache and revoking wildcard `.atyg.org` / host cookies, redirect the browser to `/login?redirect=${encodeURIComponent(safeRedirect)}` (or direct return) to keep consumer navigation intact without breaking UX.
2. **Central SSO Application Launchpad (App Switcher):**
* When users log in directly on `auth.atyg.org/login` without a `?redirect=` parameter (or navigate to `/dashboard`), the default landing page must act as an intuitive SSO Launchpad.
* Query PostgreSQL `apps` and `grants` for the authenticated `userId` and render interactive application cards (e.g. ED-Droid Hub, Grafana Telemetry, Portainer Admin, IAM Console) with 1-click launch links and role indicators (`Admin`, `Operator`, `Viewer`).
* For Global Admins (`isGlobalAdmin = true`), display all fleet applications and direct links to user/grant management.
3. **Hybrid Ingress Routing Pattern & Playbook:**
* Document and provide concrete reference configurations for consumer web applications that require hybrid public splash views alongside protected private cockpits.
* Clarify the dual-routing pattern: Traefik edge ForwardAuth protection for `/control-panel`, `/ws`, `/api/*` + App/SDK-level SSR hydration on root `/`.
4. **Strict Additive Security & Regression Audit:**
* Ensure that adding dynamic launchpad tiles and logout redirect preservation introduces zero regressions or vulnerabilities:
- Open-Redirect Prevention (CWE-601): Absolute strict whitelist validation.
- Zero-Trust Default-Deny RBAC: Verify `isGlobalAdmin` and `getUserGrant` continue to strictly govern application tile visibility and ingress grant injection.
- RFC 9421 Edge Signatures, WebAuthn PRF (3.1), 2-of-3 SSS Recovery (3.3), and RFC 6962 Merkle Tree Audit Ledger (3.4) must remain 100% untouched and operational.
- Maintain 100% test coverage across all existing and new unit tests.
**Your Task:**
1. Research the existing UI components in `ui/`, database schemas in `server/db.ts`, session handling in `server/auth-session.ts`, and redirect specs in `docs/FORWARDAUTH_REDIRECT_SPEC.md`.
2. Map out the `Target Files`, required UI component updates (`AppLaunchpadPage.tsx` / `SessionsPage.tsx`), route handlers in `ui/mod.ts`, and test cases in `server/main.test.ts`.
3. Draft the task file in `tasks/new/` strictly adhering to the naming conventions, header metadata, and mandatory structure defined in `tasks/GUIDELINES.md`.
```